Skip to content

Commit ae9d1c4

Browse files
csatib02csatib02
committed
feat: move in fluentd-drain-watch
Signed-off-by: Bence Csati <[email protected]>
1 parent 6f0c43b commit ae9d1c4

File tree

8 files changed

+235
-14
lines changed

8 files changed

+235
-14
lines changed

‎.github/workflows/dependency-images.yaml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,15 @@ jobs:
5050
contents: read
5151
packages: write
5252
id-token: write
53-
security-events: write
53+
security-events: write
54+
55+
fluentd-drain-watch:
56+
name: Fluentd drain watch
57+
uses: ./.github/workflows/fluentd-drain-watch.yaml
58+
with:
59+
publish: ${{ inputs.publish }}
60+
permissions:
61+
contents: read
62+
packages: write
63+
id-token: write
64+
security-events: write

‎.github/workflows/fluentd-drain-watch.yaml

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
name: Fluentd drain watch
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
12+
permissions:
13+
contents: read
14+
15+
16+
jobs:
17+
fluentd-drain-watch-image:
18+
name: Fluentd drain watch image
19+
runs-on: ubuntu-latest
20+
21+
permissions:
22+
contents: read
23+
packages: write
24+
id-token: write
25+
security-events: write
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
31+
- name: Set up QEMU
32+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
33+
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
36+
37+
- name: Set up Cosign
38+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
39+
if: ${{ inputs.publish }}
40+
41+
- name: Set image name
42+
id: image-name
43+
run: echo "value=ghcr.io/${{ github.repository }}/fluentd-drain-watch" >> "$GITHUB_OUTPUT"
44+
45+
- name: Gather build metadata
46+
id: meta
47+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
48+
with:
49+
images: ${{ steps.image-name.outputs.value }}
50+
flavor: |
51+
latest = false
52+
tags: |
53+
type=ref,event=branch
54+
type=ref,event=pr
55+
type=semver,pattern={{raw}}
56+
type=raw,value=latest,enable={{is_default_branch}}
57+
labels: |
58+
org.opencontainers.image.description=Fluentd drain watch image for the Logging operator.
59+
org.opencontainers.image.title=Logging operator Fluentd drain watch image
60+
org.opencontainers.image.authors=Kube logging authors
61+
org.opencontainers.image.documentation=https://kube-logging.dev/docs/
62+
63+
- name: Login to GitHub Container Registry
64+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
65+
with:
66+
registry: ghcr.io
67+
username: ${{ github.actor }}
68+
password: ${{ github.token }}
69+
if: ${{ inputs.publish }}
70+
71+
- name: Build and push fluentd-drain-watch image
72+
id: build
73+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
74+
with:
75+
context: images/fluentd-drain-watch
76+
platforms: linux/amd64,linux/arm64
77+
tags: ${{ steps.meta.outputs.tags }}
78+
labels: ${{ steps.meta.outputs.labels }}
79+
cache-from: type=gha
80+
cache-to: type=gha,mode=max
81+
outputs: |
82+
type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
83+
type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
84+
85+
- name: Sign image with GitHub OIDC Token
86+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
87+
env:
88+
DIGEST: ${{ steps.build.outputs.digest }}
89+
TAGS: ${{ steps.meta.outputs.tags }}
90+
run: |
91+
images=""
92+
for tag in ${TAGS[@]}; do
93+
images+="${tag}@${DIGEST} "
94+
done
95+
96+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}
97+
98+
- name: Verify signed image with cosign
99+
if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
100+
env:
101+
DIGEST: ${{ steps.build.outputs.digest }}
102+
TAGS: ${{ steps.meta.outputs.tags }}
103+
run: |
104+
for tag in ${TAGS[@]}; do
105+
cosign verify "${tag}@${DIGEST}" \
106+
--rekor-url "https://rekor.sigstore.dev/" \
107+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/fluentd-drain-watch.yaml@${{ github.ref }}" \
108+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
109+
done
110+
111+
- name: Extract OCI tarball
112+
run: |
113+
mkdir -p image
114+
tar -xf image.tar -C image
115+
116+
- name: Run Trivy vulnerability scanner
117+
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # 0.30.0
118+
env:
119+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
120+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
121+
with:
122+
input: image
123+
format: sarif
124+
output: trivy-results.sarif
125+
126+
- name: Upload Trivy scan results as artifact
127+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
128+
with:
129+
name: "[${{ github.job }}] Trivy scan results"
130+
path: trivy-results.sarif
131+
retention-days: 5
132+
133+
- name: Upload Trivy scan results to GitHub Security tab
134+
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
135+
with:
136+
sarif_file: trivy-results.sarif

‎Makefile

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,15 +44,13 @@ GOVERSION := $(shell go env GOVERSION)
4444
FLUENTD_IMG ?= fluentd-full:local
4545
CONFIG_RELOADER_IMG ?= config-reloader:local
4646
SYSLOG_NG_RELOADER_IMG ?= syslog-ng-reloader:local
47+
FLUENTD_DRAIN_WATCH_IMG ?= fluentd-drain-watch:local
4748
OPERATOR_IMG ?= controller:local
4849
OPERATOR_IMG_DEBUG ?= controller:debug
4950

5051
# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
5152
CRD_OPTIONS ?= crd:maxDescLen=0
5253

53-
DRAIN_WATCH_IMAGE_TAG_NAME ?= ghcr.io/kube-logging/fluentd-drain-watch
54-
DRAIN_WATCH_IMAGE_TAG_VERSION ?= latest
55-
5654
VERSION := $(shell git describe --abbrev=0 --tags)
5755

5856
E2E_TEST_TIMEOUT ?= 20m
@@ -117,11 +115,12 @@ docker-build-e2e-test: ## Build the coverage docker image
117115
sed -i'' -e 's@image: .*@image: '"${OPERATOR_IMG}"'@' ./config/default/manager_image_patch.yaml
118116
${DOCKER} build -t ${CONFIG_RELOADER_IMG} images/config-reloader
119117
${DOCKER} build -t ${SYSLOG_NG_RELOADER_IMG} images/syslog-ng-reloader
118+
${DOCKER} build -t ${FLUENTD_DRAIN_WATCH_IMG} images/fluentd-drain-watch
120119
${DOCKER} build -t ${FLUENTD_IMG} --target full images/fluentd
121120

122121
.PHONY: docker-build-drain-watch
123122
docker-build-drain-watch: ## Build the drain-watch docker image
124-
${DOCKER} build drain-watch-image -t ${DRAIN_WATCH_IMAGE_TAG_NAME}:${DRAIN_WATCH_IMAGE_TAG_VERSION}
123+
${DOCKER} build drain-watch-image -t ${FLUENTD_DRAIN_WATCH_IMG} images/fluentd-drain-watch
125124

126125
.PHONY: docker-push
127126
docker-push: ## Push the docker image

‎images/fluentd-drain-watch/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
FROM alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
2+
3+
RUN apk add curl
4+
5+
COPY drain-watch.sh /bin/drain-watch.sh
6+
7+
ENTRYPOINT ["/bin/drain-watch.sh"]

‎images/fluentd-drain-watch/README.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Fluentd Drain Watch
2+
3+
Fluentd Drain Watch is a monitoring script that ensures proper shutdown of Fluentd by waiting for its RPC endpoint to become available, monitoring buffer files, and terminating custom workers when no buffers remain.
4+
5+
## Features
6+
7+
- Waits for Fluentd's RPC endpoint to be available before proceeding.
8+
- Monitors a custom-runner HTTP endpoint.
9+
- Ensures all buffer files are processed before exiting.
10+
- Triggers termination of custom workers upon completion.
11+
12+
## Usage
13+
14+
Set required environment variables before running:
15+
16+
```sh
17+
export BUFFER_PATH=/path/to/buffers
18+
export CHECK_INTERVAL=60 # Optional, default is 60 seconds
19+
export RPC_ADDRESS=127.0.0.1:24444 # Optional, default is 127.0.0.1:24444
20+
export CUSTOM_RUNNER_ADDRESS=127.0.0.1:7357 # Optional, default is 127.0.0.1:7357
21+
```

‎images/fluentd-drain-watch/drain-watch.sh

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/bin/sh
2+
3+
CHECK_INTERVAL="${CHECK_INTERVAL:-60}"
4+
RPC_ADDRESS="${RPC_ADDRESS:-127.0.0.1:24444}"
5+
CUSTOM_RUNNER_ADDRESS="${CUSTOM_RUNNER_ADDRESS:-127.0.0.1:7357}"
6+
7+
[ -z "$BUFFER_PATH" ] && exit 2
8+
9+
# this loop will not go on indefinitely because the fluentd RPC endpoint should
10+
# come up eventually and won't terminate without a signal from outside (barring errors)
11+
echo '['$(date)']' 'waiting for fluentd RPC endpoint to become available'
12+
until netstat -tln | grep "$RPC_ADDRESS" >/dev/null
13+
do
14+
[ -z "$DEBUG" ] && echo '['$(date)']' 'fluentd RPC endpoint not available, waiting'
15+
sleep 1
16+
done
17+
18+
# this loop will not go on indefinitely because the custom-runner's HTTP endpoint should
19+
# come up eventually and won't terminate without a signal from outside (barring errors)
20+
echo '['$(date)']' 'waiting for custom-runner HTTP endpoint to become available'
21+
until curl -so /dev/null ${CUSTOM_RUNNER_ADDRESS}
22+
do
23+
[ -z "$DEBUG" ] && echo '['$(date)']' 'custom-runner HTTP endpoint not available, waiting'
24+
sleep 1
25+
done
26+
27+
echo '['$(date)']' 'waiting for fluentd to exit' # i.e. stop listening on the RPC address
28+
while netstat -tln | grep "$RPC_ADDRESS" >/dev/null
29+
do
30+
[ -z "$DEBUG" ] && echo '['$(date)']' 'RPC endpoint still listening'
31+
32+
if [ "$(find $BUFFER_PATH -iname '*.buffer' -or -iname '*.buffer.meta' | wc -l)" = 0 ]
33+
then
34+
echo '['$(date)']' 'exiting node exporter custom runner:' "$(curl --silent --show-error http://$CUSTOM_RUNNER_ADDRESS/exit)"
35+
echo '['$(date)']' 'no buffers left, terminating workers:' "$(curl --silent --show-error http://$RPC_ADDRESS/api/processes.killWorkers)"
36+
exit 0
37+
fi
38+
39+
sleep "$CHECK_INTERVAL"
40+
done
41+
42+
echo '['$(date)']' 'checking for remaining buffers'
43+
[ "$(find $BUFFER_PATH -iname '*.buffer' -or -iname '*.buffer.meta' | wc -l)" -gt 0 ] && exit 1
44+
45+
exit 0

‎pkg/sdk/logging/api/v1beta1/fluentd_types.go

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -239,12 +239,10 @@ func (f *FluentdSpec) SetDefaults() error {
239239
f.ConfigReloaderImage.Repository = DefaultFluentdConfigReloaderImageRepository
240240
}
241241
if f.ConfigReloaderImage.Tag == "" {
242-
if f.ConfigReloaderImage.Tag == "" {
243-
if Version == "" {
244-
f.ConfigReloaderImage.Tag = DefaultFluentdConfigReloaderImageTag
245-
} else {
246-
f.ConfigReloaderImage.Tag = Version
247-
}
242+
if Version == "" {
243+
f.ConfigReloaderImage.Tag = DefaultFluentdConfigReloaderImageTag
244+
} else {
245+
f.ConfigReloaderImage.Tag = Version
248246
}
249247
}
250248
if f.ConfigReloaderImage.PullPolicy == "" {
@@ -312,7 +310,11 @@ func (f *FluentdSpec) SetDefaults() error {
312310
f.Scaling.Drain.Image.Repository = DefaultFluentdDrainWatchImageRepository
313311
}
314312
if f.Scaling.Drain.Image.Tag == "" {
315-
f.Scaling.Drain.Image.Tag = DefaultFluentdDrainWatchImageTag
313+
if Version == "" {
314+
f.Scaling.Drain.Image.Tag = DefaultFluentdDrainWatchImageTag
315+
} else {
316+
f.Scaling.Drain.Image.Tag = Version
317+
}
316318
}
317319
if f.Scaling.Drain.Image.PullPolicy == "" {
318320
f.Scaling.Drain.Image.PullPolicy = "IfNotPresent"

‎pkg/sdk/logging/api/v1beta1/logging_types.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -209,8 +209,8 @@ const (
209209
DefaultFluentdImageRepository = "ghcr.io/kube-logging/logging-operator/fluentd"
210210
DefaultFluentdImageTag = "latest-full"
211211
DefaultFluentdBufferStorageVolumeName = "fluentd-buffer"
212-
DefaultFluentdDrainWatchImageRepository = "ghcr.io/kube-logging/fluentd-drain-watch"
213-
DefaultFluentdDrainWatchImageTag = "v0.2.4"
212+
DefaultFluentdDrainWatchImageRepository = "ghcr.io/kube-logging/logging-operator/fluentd-drain-watch"
213+
DefaultFluentdDrainWatchImageTag = "latest"
214214
DefaultFluentdDrainPauseImageRepository = "registry.k8s.io/pause"
215215
DefaultFluentdDrainPauseImageTag = "3.9"
216216
DefaultFluentdVolumeModeImageRepository = "docker.io/library/busybox"

0 commit comments

Comments
 (0)